cnvd - cnvd-2017-33595

cnvd-2017-33595

Vulnerability from cnvd

Title: Google Chrome域欺骗漏洞（CNVD-2017-33595）

Description:

Google Chrome for Linux、Windows、Mac和Android是美国谷歌（Google）公司开发的一款基于Linux、Windows、Mac和Android平台的Web浏览器。Omnibox是其中的一个实时搜索引擎。

基于Mac、 Windows、Linux和Android平台的Google Chrome中的Omnibox存在安全漏洞，该漏洞源于程序未能充分的强制执行策略。远程攻击者可借助特制域名中IDN的同形异义词利用该漏洞伪造域名。

Severity: 中

Patch Name: Google Chrome域欺骗漏洞（CNVD-2017-33595）的补丁

Patch Description:

基于Mac、 Windows、Linux和Android平台的Google Chrome中的Omnibox存在安全漏洞，该漏洞源于程序未能充分的强制执行策略。远程攻击者可借助特制域名中IDN的同形异义词利用该漏洞伪造域名。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://security.gentoo.org/glsa/201709-15

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-5105 http://www.securityfocus.com/bid/99950

Impacted products

Name
Google Chrome <60.0.3112.78

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "99950"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5105"
    }
  },
  "description": "Google Chrome for Linux\u3001Windows\u3001Mac\u548cAndroid\u662f\u7f8e\u56fd\u8c37\u6b4c\uff08Google\uff09\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u6b3e\u57fa\u4e8eLinux\u3001Windows\u3001Mac\u548cAndroid\u5e73\u53f0\u7684Web\u6d4f\u89c8\u5668\u3002Omnibox\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5b9e\u65f6\u641c\u7d22\u5f15\u64ce\u3002\r\n\r\n\u57fa\u4e8eMac\u3001 Windows\u3001Linux\u548cAndroid\u5e73\u53f0\u7684Google Chrome\u4e2d\u7684Omnibox\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u5f3a\u5236\u6267\u884c\u7b56\u7565\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u57df\u540d\u4e2dIDN\u7684\u540c\u5f62\u5f02\u4e49\u8bcd\u5229\u7528\u8be5\u6f0f\u6d1e\u4f2a\u9020\u57df\u540d\u3002",
  "discovererName": "Ned Williamson, Yu Zhou, Yuan Deng of Ant-financial Light-Year Security Lab, Luan Herrera, Anonymous, Takeshi Terada, Jihoon Kim, Khalil Zhani, Chaitin Security Research Lab, Rayyan Bijoora, Jack Zac, David Kohlbrenner of UC San Diego, Guang Gong of Alpha",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://security.gentoo.org/glsa/201709-15",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-33595",
  "openTime": "2017-11-13",
  "patchDescription": "Google Chrome for Linux\u3001Windows\u3001Mac\u548cAndroid\u662f\u7f8e\u56fd\u8c37\u6b4c\uff08Google\uff09\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u6b3e\u57fa\u4e8eLinux\u3001Windows\u3001Mac\u548cAndroid\u5e73\u53f0\u7684Web\u6d4f\u89c8\u5668\u3002Omnibox\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5b9e\u65f6\u641c\u7d22\u5f15\u64ce\u3002\r\n\r\n\u57fa\u4e8eMac\u3001 Windows\u3001Linux\u548cAndroid\u5e73\u53f0\u7684Google Chrome\u4e2d\u7684Omnibox\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u5f3a\u5236\u6267\u884c\u7b56\u7565\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u57df\u540d\u4e2dIDN\u7684\u540c\u5f62\u5f02\u4e49\u8bcd\u5229\u7528\u8be5\u6f0f\u6d1e\u4f2a\u9020\u57df\u540d\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Google Chrome\u57df\u6b3a\u9a97\u6f0f\u6d1e\uff08CNVD-2017-33595\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Google Chrome \u003c60.0.3112.78"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-5105\r\nhttp://www.securityfocus.com/bid/99950",
  "serverity": "\u4e2d",
  "submitTime": "2017-10-30",
  "title": "Google Chrome\u57df\u6b3a\u9a97\u6f0f\u6d1e\uff08CNVD-2017-33595\uff09"
}

CVE-2017-5105 (GCVE-0-2017-5105)

Vulnerability from cvelistv5

Published

2017-10-27 05:00

Modified

2024-08-05 14:47

Severity ?

CWE

Insufficient Policy Enforcement

Summary

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

References

▼	URL	Tags
	https://security.gentoo.org/glsa/201709-15	vendor-advisory, x_refsource_GENTOO
	http://www.debian.org/security/2017/dsa-3926	vendor-advisory, x_refsource_DEBIAN
	https://crbug.com/729979	x_refsource_MISC
	https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html	x_refsource_MISC
	http://www.securityfocus.com/bid/99950	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2017:1833	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux and Android	Version: Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux and Android

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:47:44.429Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201709-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201709-15"
          },
          {
            "name": "DSA-3926",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3926"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://crbug.com/729979"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html"
          },
          {
            "name": "99950",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99950"
          },
          {
            "name": "RHSA-2017:1833",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1833"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux and Android",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux and Android"
            }
          ]
        }
      ],
      "datePublic": "2017-07-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Insufficient Policy Enforcement",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "name": "GLSA-201709-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201709-15"
        },
        {
          "name": "DSA-3926",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3926"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://crbug.com/729979"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html"
        },
        {
          "name": "99950",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99950"
        },
        {
          "name": "RHSA-2017:1833",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1833"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@google.com",
          "ID": "CVE-2017-5105",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux and Android",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux and Android"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Insufficient Policy Enforcement"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201709-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201709-15"
            },
            {
              "name": "DSA-3926",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3926"
            },
            {
              "name": "https://crbug.com/729979",
              "refsource": "MISC",
              "url": "https://crbug.com/729979"
            },
            {
              "name": "https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html",
              "refsource": "MISC",
              "url": "https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html"
            },
            {
              "name": "99950",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99950"
            },
            {
              "name": "RHSA-2017:1833",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1833"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2017-5105",
    "datePublished": "2017-10-27T05:00:00",
    "dateReserved": "2017-01-02T00:00:00",
    "dateUpdated": "2024-08-05T14:47:44.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted